longz
2026-08-28 7f714c7179233affc2715f38f59946e5906654a3
删除越权漏洞修复中的内部调用注解
5个文件已修改
32 ■■■■■ 已修改文件
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysOperlogController.java 1 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java 18 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java 1 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java 1 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java 11 ●●●●● 补丁 | 查看 | 原始文档 | blame | 历史
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysOperlogController.java
@@ -83,7 +83,6 @@
        return success();
    }
    
    @InnerAuth
    @PostMapping
    public AjaxResult add(@RequestBody SysOperLog operLog) {
        return toAjax(operLogService.insertOperlog(operLog));
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserController.java
@@ -317,14 +317,12 @@
    }
    @InnerAuth
    @PostMapping("/getUserList")
    public R<List<SysUser>> getUserList(@RequestBody List<Integer> userIds) {
        List<SysUser> list = userService.list(new LambdaQueryWrapper<SysUser>().in(SysUser::getUserId, userIds));
        return R.ok(list);
    }
    @InnerAuth
    @PostMapping("/getSysUserFromCompanyId")
    public R<List<CompanyUserListVo>> getSysUserFromCompanyId(@RequestBody CompanySysUserReq companySysUserReq) {
        LambdaQueryWrapper<SysUser> sysUserLambdaQueryWrapper = new LambdaQueryWrapper<>();
@@ -372,7 +370,6 @@
        }
        return R.ok(companyUserListVos);
    }
    @InnerAuth
    @PostMapping("/isAdmin")
    public R<Integer> isAdmin(@RequestBody Long userId){
        SysUserRole one = sysUserRoleService.getOne(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
@@ -380,7 +377,6 @@
        return R.ok(id.intValue());
    }
    @InnerAuth
    @PostMapping("/getSysUser")
    public R<SysUser> getSysUser(@RequestParam("userId") Long userId) {
        try {
@@ -392,7 +388,6 @@
        }
    }
    @InnerAuth
    @PostMapping("/updateSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R<Boolean> updateSysUser(@RequestBody SysUser sysUser) {
@@ -415,7 +410,6 @@
    }
    @InnerAuth
    @PostMapping("/companySaveSysUser")
    public R<List<Integer>> companySaveSysUser(@RequestBody CompanyAddSysUserDto dto) {
        List<CompanyUserListVo> list = dto.getList();
@@ -465,7 +459,6 @@
    }
    @InnerAuth
    @PostMapping("/addTRepairSysUser")
    public R<List<Integer>> addTRepairSysUser(@RequestBody TRepairShopAddDto dto) {
        List<TRepairShopAdd> list = dto.getList();
@@ -501,7 +494,6 @@
    /**
     * 获取当前用户信息
     */
    @InnerAuth
    @GetMapping("/info/{username}")
    public R<LoginUser> info(@PathVariable("username") String username) {
        SysUser sysUser = userService.selectUserByUserName(username);
@@ -620,7 +612,6 @@
        return success(deptService.selectDeptTreeList(dept));
    }
    @InnerAuth
    @PostMapping("/updateUser")
    public R<Boolean>  updateUser(@RequestBody SysUser sysUser){
        return R.ok(userService.updateById(sysUser));
@@ -631,7 +622,6 @@
     * @param userId
     * @return
     */
    @InnerAuth
    @PostMapping("/queryRoleByUserId/{userId}")
    public R<SysRole> queryRoleByUserId(@PathVariable("userId") Long userId){
        SysUserRole one = sysUserRoleService.getOne(Wrappers.lambdaQuery(SysUserRole.class)
@@ -648,7 +638,6 @@
    }
    @InnerAuth
    @PostMapping("/queryRoleByRoleId/{roleId}")
    public R<SysRole> queryRoleByRoleId(@PathVariable("roleId") Long roleId){
        return R.ok( roleService.getOne(Wrappers.lambdaQuery(SysRole.class)
@@ -661,7 +650,6 @@
     * @param phoneList
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhoneList")
    public R<List<SysUser>> queryUserByPhoneList(@RequestBody List<String> phoneList){
        List<SysUser> list = userService.list(Wrappers.lambdaQuery(SysUser.class)
@@ -675,7 +663,6 @@
     * @param dtoList
     * @return
     */
    @InnerAuth
    @PostMapping("/addUserRole")
    public R<Boolean> addUserRole(@RequestBody List<SysUserRoleDTO> dtoList){
        List<SysUserRole> userRoles = new ArrayList<>();
@@ -693,7 +680,6 @@
     * @param phone
     * @return
     */
    @InnerAuth
    @PostMapping("/queryUserByPhone")
    public R<SysUser>  queryUserByPhone(@RequestBody String phone){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -709,7 +695,6 @@
     * @return
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/queryUserByUserName")
    public R<SysUser> queryUserByUserName(@RequestBody String userName){
        SysUser user = userService.getOne(Wrappers.lambdaQuery(SysUser.class)
@@ -724,7 +709,6 @@
     * @param user
     */
    @ResponseBody
    @InnerAuth
    @PostMapping("/addSysUser")
    @Transactional(rollbackFor = Exception.class)
    public R<Long> addSysUser(@RequestBody SysUser user) {
@@ -756,7 +740,6 @@
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/resetPassword")
    public R resetPassword(@RequestBody SysUser user) {
        user.setPassword(SecurityUtils.encryptPassword(user.getPassword()));
@@ -767,7 +750,6 @@
    
    
    @ResponseBody
    @InnerAuth
    @PostMapping("/getSysUserById")
    public SysUser getSysUserById(@RequestParam("userId") Long userId){
        return userService.getById(userId);
ruoyi-modules/ruoyi-system/src/main/java/com/ruoyi/system/controller/SysUserRoleController.java
@@ -104,7 +104,6 @@
     * @param userId
     * @return
     */
    @InnerAuth
    @PostMapping("/getRoleByUserId")
    public R<List<SysUserRoleVo>> getRoleByUserId(@RequestParam("userId") Long userId){
        List<SysUserRole> list = sysUserRoleService.list(new LambdaQueryWrapper<SysUserRole>().eq(SysUserRole::getUserId, userId));
ruoyi-service/ruoyi-account/src/main/java/com/ruoyi/account/controller/TAppUserController.java
@@ -262,7 +262,6 @@
     * 远程调用 积分兑换订单 退款回退积分
     * @return
     */
    @InnerAuth
    @PostMapping(value = "/refundPoints/{param}")
    public R refundPoints(@PathVariable("param")String param) {
        String[] split = param.split("-");
ruoyi-service/ruoyi-chargingPile/src/main/java/com/ruoyi/chargingPile/controller/TChargingGunController.java
@@ -72,7 +72,6 @@
     * 新增临时枪
     * @return
     */
    @InnerAuth
    @PostMapping("/addGunTemp")
    @ResponseBody
    R<Integer> addGunTemp(@RequestBody TChargingGun gun){
@@ -82,7 +81,6 @@
    /**
     * 查询所有枪
     */
    @InnerAuth
    @PostMapping(value = "/getAllGun")
    @ResponseBody
    public R<List<TChargingGun>> getAllGun() {
@@ -91,7 +89,6 @@
    /**
     * 查询所有桩
     */
    @InnerAuth
    @PostMapping(value = "/getAllPile")
    public R<List<TChargingPile>> getAllPile() {
        return R.ok(chargingPileService.list());
@@ -254,7 +251,6 @@
     * @return
     */
    @ResponseBody
    @InnerAuth
    @PostMapping(value = "/getAllName/{id}")
    public R<String> getAllName(@PathVariable Integer id){
        TChargingGun chargingGun = chargingGunService.getById(id);
@@ -269,7 +265,6 @@
     * @return
     */
    @ResponseBody
    @InnerAuth
    @PostMapping(value = "/getChargingGunById/{id}")
    public R<TChargingGun> getChargingGunById(@PathVariable Integer id){
        TChargingGun chargingGun = chargingGunService.getById(id);
@@ -281,7 +276,6 @@
     * @return
     */
    @ResponseBody
    @InnerAuth
    @PostMapping(value = "/getAllInfoById/{id}")
    public R<SiteNameVO> getAllInfoById(@PathVariable Integer id){
        SiteNameVO siteNameVO = new SiteNameVO();
@@ -300,7 +294,6 @@
     * @param code
     * @return
     */
    @InnerAuth
    @PostMapping("/getChargingGunByCode")
    public R<TChargingGun> getChargingGunByCode(@RequestBody GetChargingGunByCode code){
        TChargingPile chargingPile = chargingPileService.getOne(new LambdaQueryWrapper<TChargingPile>()
@@ -321,7 +314,6 @@
     * @param chargingGun
     * @return
     */
    @InnerAuth
    @PostMapping("/updateChargingGunById")
    public R<String> updateChargingGunById(@RequestBody TChargingGun chargingGun){
        chargingGunService.updateById(chargingGun);
@@ -335,7 +327,6 @@
     * @param chargingPileId
     * @return
     */
    @InnerAuth
    @PostMapping("/getChargingGunByChargingPileId")
    public R<List<TChargingGun>> getChargingGunByChargingPileId(@RequestParam("chargingPileId") Integer chargingPileId){
        List<TChargingGun> list = chargingGunService.list(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getChargingPileId, chargingPileId)
@@ -348,7 +339,6 @@
     * 根据充电桩ids获取枪
     * @return
     */
    @InnerAuth
    @PostMapping("/getChargingGunByChargingPileIds")
    public R<List<TChargingGun>> getChargingGunByChargingPileIds(@RequestBody GetChargingGunByChargingPileIdsVo vo){
        if(vo.getChargingPileIds().isEmpty()){
@@ -364,7 +354,6 @@
     * 根据枪唯一码查询信息
     * @return
     */
    @InnerAuth
    @PostMapping("/getChargingGunByFullNumber")
    public R<TChargingGun> getChargingGunByFullNumber(@RequestParam("fullNumber") String fullNumber){
        TChargingGun chargingGun = chargingGunService.getOne(new LambdaQueryWrapper<TChargingGun>().eq(TChargingGun::getDelFlag, 0).eq(TChargingGun::getFullNumber, fullNumber));